Exploring AI Agent Applications in Network Security with Hermes on Kali

Introduction

The author investigates how an AI agent, Hermes, can assist in network security tasks on a Kali Linux environment, emphasizing that the experiments are conducted in a safe internal network and that any malicious use of AI is strictly prohibited.

Information Collection

The AI is prompted with the following request:

“Please collect information about the device with IP 192.168.50.44 and give me relevant suggestions.”

The AI then initiates an Nmap scan of the target host.

Scan Report

22/tcp – SSH – OpenSSH 9.2p1 Debian – High risk

21/tcp – FTP – vsftpd 3.0.3 – Medium risk

80/tcp – HTTP – nginx (404 empty page) – Low risk

888/tcp – HTTP – nginx (404 empty page) – Low risk

111/tcp – rpcbind – 2‑4 – Medium risk

3306/tcp – MySQL – (unauthorized access limited) – Medium risk

5201/tcp – iperf3 – bandwidth testing service – Medium risk

26499/tcp – SSL/unknown – self‑signed certificate (MD5!) – High risk

42781/tcp – RPC status – 1 (RPC #100024) – Low risk

Password Cracking

After identifying open SSH and MySQL ports, the AI is asked to perform a short password recovery test. The following Hydra command is generated and executed:

hydra -L /root/user.txt -P /root/pass.txt -t 4 -f -V ssh://192.168.50.44

This command attempts to brute‑force the SSH service using username and password lists stored in /root/user.txt and /root/pass.txt, with four parallel threads, stopping on the first successful login.

Additional Information – rpcbind

The scan also reveals that the rpcbind service on port 111 is exposed, which poses a security risk. The author notes limited familiarity with rpcbind and suggests that the AI can be consulted for further testing and explanation of this service.

“In the scan I saw an exposed rpcbind (port 111). In the current Kali environment, invoke the relevant tool for security testing and report the result.”

The AI provides a security report for the rpcbind issue, and the author encourages readers to ask the AI for clarification whenever a step is unclear.

Conclusion

The walkthrough shows that AI agents can streamline routine security operations—such as reconnaissance, vulnerability assessment, and password cracking—by generating commands and interpreting results, making the learning process more convenient for beginners.